We first demonstrate the effectiveness of data augmentation at mitigating backdoor attacks while at the same time increasing test accuracy. To establish baselines for backdoor attacks, we train a ResNet-18 [1]} on the CIFAR-10 dataset consisting of \(50,000\)  images in 10 balanced classes [2]}. We insert triggers into the training set by adding \(4 \times 4\)  patches to training images in a randomly selected target class.
We then evaluate on patched images from a new base class to see if the patch triggers images to be misclassified into the target class. We perform this experiment in two different settings: when all training images are patched in the base class and only 10% of training images are patched in this class. These two scenarios reflect varying access an adversary might have to their victim's training data.
